Technical Tip: Delete blocked IPs page via REST API

Description

This article describes how to use curl/Postman to delete the FortiView Blocked IPs page on Source IP due to Block Period action using the REST API.

Scope

FortiWeb v6.3 and later.

Solution

When an IP is blocked due to a web policy violation, it enters the configured Block Period and there will be expiration time before the IP is released.

Administrators can also utilize the REST API to delete the blocked IP for immediate IP release from Block action.

Refer to this Technical Tip: Monitor Blocked IPs page via REST API to get a real-time list of Blocked IP.

Prepare cURL commands that meet the required format specifications for the request.

1. Request Method: DELETE.

2. Host header.

3. Authorization header.

Encode the string with BASE64 and use it as an Authorization token.

{“username”:”admin”,”password”:“a”,”vdom”:”root”}

Example:

$ echo ‘{“username”:”admin”,”password”:”fortinet”,”vdom”:”root”}’ | base64
eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJmb3J0aW5ldCIsInZkb20iOiJyb290In0K

A sample of the cURL command would look like this:

curl -k -X DELETE 'https://<FWB-IP> /api/v2.0/monitor/blockedips?policy_name=<policy-name>' \

-H 'Authorization:<token>' \

-H 'Content-Type: application/json' \

-d '{
"ip_list": ["<ip>"]
}'

Steps to perform in Postman:

1. Open Postman.

2. Select the Import tab on the upper left side.
   
   

   

   
   

3. Paste the cURL command in the import field.
   
   

   

   
   

4. Verify the request information and select Send.
   
   

   

   
   

5. REST API result.
   
   

   

FortiView Blocked IPs documentation:

Blocked IPs 

For more information, refer to FortiWeb RESTful API Reference (requires 2 Fortinet sponsors):
FortiWeb REST API Reference